{"affected":[{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openscap-main","product":"Red Hat Hardened Images","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.4.5-2.1.hum1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openscap","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openscap","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openscap","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openscap","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openscap","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-85518","cwes":["CWE-22"],"description":"A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.","epss":{"date":"2026-11-05","percentile":0.39023,"score":0.00447},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478522"}],"kev":null,"metrics":[{"score":6.1,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","version":"3.1"}],"modifiedAt":1793927297309,"publishedAt":1792611774174,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:88330"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-85518"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478522"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478522"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Avoid extracting or decomposing untrusted SCAP Source DataStream (SDS) files. When processing externally supplied datastreams is necessary, perform the operation inside an isolated directory using a dedicated unprivileged user account or container sandbox with strictly bounded write privileges.\n\nCaveat: Operating under an unprivileged user confines rogue file creation to that user's access scope, but does not prevent file corruption within directories accessible to that account."}],"revision":"1a2873f9f2b8177976c3b48b7f8b48cbdfd9832f2600f29274b4173adfedba31","sources":[{"modifiedAt":1793927297309,"name":"CNA: redhat","retrievedAt":1793931007485,"url":"https://www.cve.org/CVERecord?id=CVE-2026-85518"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793931024418,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85518"}],"ssvc":{"assessedAt":1793210877209,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition","updatedAt":1793931024418}